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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report addresses the strengths and weaknesses of the Transportation Security 
Administration's assistance provided to Amtrak for mitigating known vulnerabilities at 
high-risk rail stations. It is based on interviews with employees and officials of relevant 
agencies and institutions, direct observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




Anne L. Richards 

Assistant Inspector General for Audits 
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Executive Summary 

Amtrak provides passenger rail service over approximately 22,000 
miles in 46 states and the District of Columbia. Amtrak operates 
more than 500 stations and transports about 27 million passengers 
every year, using infrastructure including tunnels, bridges, and 
major rail stations. Passenger rail stations are attractive terrorist 
targets because of the large number of people in a concentrated 
area. We determined whether the Department of Homeland 
Security ensures that recipients of the Transit Security Grant 
Program mitigate high-priority security vulnerabilities at Amtrak 
rail stations and whether they coordinate risk mitigation projects to 
prevent duplication and avoid uneconomical use of grant funds. 

Grant recipients, such as Amtrak, transit agencies, and state and 
local authorities, coordinate risk mitigation projects at high-risk 
rail stations. However, Amtrak is not always using grant funds to 
implement mitigation strategies at highest risk rail stations, in 
terms of casualties and economic impact. Amtrak has not 
mitigated critical vulnerabilities reported in risk assessments. 
These vulnerabilities remain because the Transportation Security 
Administration (TSA): 

• Did not require Amtrak to develop a corrective action plan 
addressing its highest ranked vulnerabilities; 

• Approved Amtrak investment justifications for lower risk 
vulnerabilities; and 

• Did not document roles and responsibilities for the grant 
award process. 

As a result, some rail stations and the traveling public may be at 
risk to a potential terrorist attack. TSA concurred with our two 
recommendations and has initiated corrective actions. 
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Background 

Since 2004, bombings of the Madrid and Mumbai rail systems and 
the London subway have demonstrated the critical need to protect 
rail infrastructure from terrorist attacks. Passenger rail stations are 
especially attractive terrorist targets because of the large number of 
people in a concentrated area. The largest of America's rail 
stations are intermodal transportation terminals with high 
passenger and cargo volumes. A terrorist attack at these facilities 
could lead to significant loss of life and economic disruption. 

The Rail Passenger Service Act of 1970, Public Law 91-518, 
established the National Railroad Passenger Corporation - Amtrak. 
Amtrak runs intercity passenger rail service over approximately 
22,000 miles in 46 states and the District of Columbia, operating 
more than 500 stations and transporting about 27 million 
passengers every year. While the Department of Transportation 
owns Amtrak, the majority of mass transit stations in this country 
are owned and operated by state and local government and private 
industry. Amtrak infrastructure consists of various critical assets 
and key resources, including tunnels, bridges, and several major 
rail stations. 

The Aviation and Transportation Security Act of 2001, Public Law 
107-71, designates the TSA responsible for security in all modes of 
transportation. It also makes TSA responsible for coordinating 
domestic transportation, including aviation, rail, and other surface 
transportation. The act identifies TSA as the lead federal agency 
for determining the security priorities eligible for federal grant 
funding and developing the criteria for evaluating applications. 

The Department of Homeland Security (DHS) has taken steps to 
manage risk and strengthen our Nation's rail and transit systems 
by: 

• Providing funding to state and local partners; 

• Training and deploying manpower; 

• Providing assets for high-risk areas; 

• Developing and testing new technologies; and 
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• Performing security assessments of systems across the 
country. 

DHS distributes billions of dollars to states, territories, urban areas, 
and transportation authorities, including Amtrak, under grant 
programs to strengthen national preparedness capabilities and 
protect critical infrastructure. The purpose of the DHS Transit 
Security Grant Program (TSGP) is to create a sustainable, risk- 
based effort to protect critical surface transportation infrastructure 
and the traveling public from acts of terrorism, major disasters, and 
other emergencies. A subcomponent of the TSGP is the Intercity 
Passenger Rail Program (IPRP), a security grant program designed 
exclusively for Amtrak. 

Since 2005, the TSGP has provided more than $1 billion in grant 
funding to Amtrak and passenger rail transit agencies to protect 
critical transportation infrastructure, including Amtrak rail stations. 
Specifically, the TSGP including the IPRP provided $97 million to 
Amtrak and $1.4 billion to transit agencies. As part of Amtrak 
grants, the IPRP funded several risk assessments of Amtrak 
facilities, including rail stations and other infrastructure. The 
assessments provided Amtrak with countermeasures that could 
reduce risks to the stations. 

Between 2005 and 2008, the Science Applications International 
Corporation (SAIC) conducted risk assessments of Amtrak 
facilities, assets, and infrastructure. SAIC documented the 
vulnerabilities of Amtrak infrastructure including rail stations and 
recommended mitigation actions. SAIC charged about 
$2.3 million for these assessments. 

Amtrak is spending an additional $5.5 million to corroborate 
subassessments to the SAIC findings. The Lawrence Livermore 
National Laboratory and OceanIT conducted site-specific analyses 
of infrastructure vulnerabilities. These included blast analyses of 
high-risk stations and analyses of the effects of a chemical or 
biological attack on heating, ventilation, and air conditioning 
systems. 
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TSA and the Federal Emergency Management Agency (FEMA) 
are responsible for administering and overseeing the TSGP and 
IPRP. These two agencies work together to develop the annual 
TSGP guidance and application kits. These kits provide Amtrak 
and transit agencies with formal guidance and application materials 
to apply for funding under the TSGP and IPRP. The kits also 
describe the TSA and FEMA program management roles and 
responsibilities: 

• TSA provides rail system subject matter expertise within 
DHS and determines the primary security planning for the 
TSGP and IPRP. TSA is the lead agency in crafting all 
selection criteria associated with the application review 
process. 

• FEMA is the lead for designing and operating the 
administrative mechanisms to manage the department's 
core grant programs, including the TSGP and IPRP. 
FEMA is also responsible for ensuring compliance with all 
relevant federal grant management requirements and 
providing grant management tools and controls to support 
the TSGP and IPRP. 

TSA and FEMA use a cooperative agreement approach to approve 
grant projects funded through the TSGP and IPRP. As part of the 
cooperative agreement process, Amtrak meets with TSA and 
FEMA representatives to develop Investment Justifications that 
align with TSGP and IPRP priorities. According to TSGP grant 
guidance, the cooperative agreement process is valuable because it 
provides greater flexibility and allows TSA to work directly with 
transit agencies to quickly adapt to changes as situations arise 
during the grant cycle. 
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Results of Audit 



DHS Did Not Ensure That Amtrak Directed Grant 
Funds to Highest Known Rail Station Vulnerabilities 

DHS grant recipients, such as Amtrak, transit agencies, and state and local 
authorities, coordinate risk mitigation projects at Amtrak high-risk rail 
stations to prevent duplication and avoid uneconomical use of grant funds. 
However, at the four rail stations we visited, Amtrak did not mitigate 
critical vulnerabilities reported in DHS-funded risk assessments. 
Although many factors contributed to Amtrak' s unaddressed station 
vulnerabilities, the primary causes were that TSA: 

• Did not require Amtrak to develop a formal corrective 
action plan documenting how it would address its highest 
ranked identified vulnerabilities, 

• Approved Amtrak investment justifications for lower risk 
vulnerabilities, and 

• Did not document roles and responsibilities for the grant 
project approval process. 

As a result, some rail stations and the traveling public may be at a greater 
risk to a potential terrorist attack. 

Grant Recipient Coordination 

Grant recipients have demonstrated coordination activities to 
ensure economical use of grant funds. For example, DHS 
encourages high-risk regions to form Regional Transit Security 
Working Groups. These working groups include eligible transit 
agencies, law enforcement agencies, and Amtrak, if stations exist 
in the region. The Regional Transit Security Working Groups 
work with each other and with TSA to identify projects that DHS 
grants can fund. 

At the station level, Amtrak employs Station Action Teams 
comprising of Amtrak Police, local Amtrak managers, local 
property management, adjacent facility owners, and transit and 
local police. The Station Action Team Coordinator facilitates the 
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formulation of strategies to minimize the effects of a threat to that 
station in conjunction with other team members, including those 
receiving DHS grant funds. 



Rail Station Vulnerabilities Remain 



TSA and FEMA did not ensure that Amtrak used TSGP funds to 
implement the more critical countermeasures the DHS-funded 
assessments recommended. Between 2005 and 2008, IPRP funded 
$7.8 million in assessments to help Amtrak strengthen rail security. 
TSA and FEMA explained that Amtrak uses these assessments to 
propose security projects for the IPRP. However, we visited four 
high-risk rail stations and observed that Amtrak did not take 
actions to mitigate some of the more critical vulnerabilities the 
assessments identified as early as 2006. 

For example, at one station (see Figure 1), we observed that a 
terrorist could accesi 



Amtral 



The 2006 assessment recommended that 
to mitigate this risk. 



DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 

Page 6 




DHS Grants Used for Mitigating Risks to Amtrak Rail Stations 

Page 7 



Corrective Action Planning 



TSA did not require Amtrak to develop a formal corrective action 
plan for mitigating station vulnerabilities identified in the 
assessments. TSA set funding priorities in the annual grant 
guidance 1 but did not require Amtrak to create a corrective action 
plan that would prioritize mitigating the identified high-risk station 
vulnerabilities, establish milestones, or estimate project costs. 
Office of Management and Budget (OMB) Circular A- 123, 
Management's Responsibility for Internal Control, directs 
management to establish and maintain internal controls, including 
policies and procedures, to achieve the objectives of effective and 
efficient operations. Further, U.S. Government Accountability 
Office (GAO) guidance indicates that a strategic plan should 
include clear and concise goals and objectives that identify 
resource issues. The plan should also address risk-related issues 
that are central to the agency's overall mission. 2 

Amtrak developed a project prioritization list, known as the 
"quilt," and a general strategy to reduce risk at its top 16 stations. 
The quilt incorporates the SAIC assessment rankings of Amtrak' s 
assets, such as rail stations, bridges, and tunnels. The quilt does 
not incorporate specific corrective measures the assessments 
recommended. Rather, it captures broad categories of remediation. 
For example, the quilt lists categories such as "Hardening Tool Kit 
(Fencing/Lighting)" and "Bollards/Planters," but does not specify 
where Amtrak should place the bollards or planters. 

Amtrak' s general strategy for risk reduction directed resources 
toward combating the highest risk facilities. Amtrak expanded the 
strategy, known as its "16+1 Station Strategy," to 16 stations after 
SAIC completed assessments of Amtrak's West Coast operations. 
Like the quilt, the Station Strategy does not provide the specific 
mitigation efforts to be taken at the 16 high-risk stations. It also 



1 TSA did not become involved in TSGP and the IPRP until 2006. TSA did not participate in the 
development of the 2005 guidance. 

2 

GAO testimony - 07-583T, Federal Strategy and Enhanced Coordination Needed to Prioritize and Guide 
Security Efforts, March 7, 2007 

3 The refers to other Amtrak assets such as electrical stations, bridges, and tunnels. 
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does not include cost estimates, timeframes, or alternatives to 
mitigation obstacles beyond Amtrak's control. 

The TSGP grant guidance kits did not require Amtrak to mitigate 
the assessment vulnerabilities as a top priority. The 2005 guidance 
kit indicates that up to 30% of fiscal year 2005 funds would be 
available to assist Amtrak with its most pressing security needs in 
its Northeast Corridor and Chicago "as identified through 
previously conducted site-specific assessments." Up to 50% of the 
fiscal year 2006 funds were available for the same purpose and 
expanded to "high priority projects" identified in assessments of its 
West Coast service area. However, neither guidance kit required 
Amtrak to expend funds on the identified vulnerabilities. 

Beginning with fiscal year 2007, the kits include a section titled 
"Funding Priorities," which identify DHS's specific priorities for 
that grant year. However, there is no indication of which are the 
highest priorities. From fiscal years 2007 through 2010, the 
guidance identified a funding priority which was "Protection of 
other high risk/high consequence assets and systems that have been 
identified through system wide risk assessments." 

Lower Priority Projects Approved 

Amtrak faces obstacles beyond its control when undertaking some 
security projects. For example, some of the recommendations in 
the risk assessments require Amtrak to make modifications in or 
around a station. Amtrak does not own all of its stations and must 
obtain permission from other parties to make the modification. 
Amtrak cannot always obtain permission to make the 
modifications. Projects may also require environmental and 
historic approvals or are subject to American with Disability Act 
restrictions. 

When addressing these obstacles, TSA's cooperative agreement 
approach permits Amtrak to use IPRP funds on projects that may 
not be the highest priority but are easier to complete. Beginning 
with the 2007 grant cycle, TSA began to use a cooperative 
agreement approach to approve TSGP and IPRP projects. This 
approach allows Amtrak to focus on remediation projects over 
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which it has control. For example, the Lawrence Livermore 
National Laboratories analysis recommended hardening the air 
intake vents at one station because the heating ventilation and air 
conditioning system is vulnerable. The station's landlord 
prevented Amtrak from implementing remediation to the vents. 
Using the cooperative agreement approach, TSA allowed Amtrak 
to use IPRP funds for other projects at the station, such as 
upgrading the closed-circuit television system. 

TSA Grant Project Decision and Approval Process Not 
Documented 

TSA has limited internal procedures documenting how it manages 
the TSGP and IPRP project decision and approval process. OMB 
Circular A- 123 says that policies and procedures are tools to help 
managers achieve results and safeguard the integrity of their 
programs. According to GAO's Standards for Internal Controls, 4 
an agency's internal control activities should include appropriate 
policies and procedures governing each of its activities. 
Additionally, control activities should include written 
documentation that covers an agency's significant transactions and 
events. Further, they should identify its activities in documents 
such as management directives and administrative policies. 

TSA officials said the following two documents contain the only 
documented procedures that describe how the agency prioritizes 
and approves projects the TSGP and IPRP funds: 

• The annual grant guidance and application kits provide an 
overview of the grant program and the required application 
materials. The guidance is intended for grant recipients and 
does not formally document TSA's internal policies and 
procedures for setting grant priorities or evaluating 
investment justifications. 

• TSA's presentation dated March 2007, "FY 2007 Transit 
Security Grant Program: Tier I Cooperative Agreement 
Approach," describes the process as a series of meetings, 



4 GAO-01-1008G, Internal Control Management and Evaluation Tool, August 2001. 
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• which typically result in a proposed project concept list. 
This is not official TSA policy that would hold the agency 
accountable for the process. 

Neither the guidance kits nor the presentation specifies how TSA 
sets grant priorities or how it will ensure that it approves only 
projects that address stated priorities. 

Limited TSGP Funds Expended on High-Risk Mitigation 

As of December 31, 2010, Amtrak had expended only 16% of 
IPRP funds TSA approved to address some of the more critical 
vulnerabilities the assessments identified. TSA's cooperative 
agreement approach and factors outside of Amtrak' s control 5 have 
delayed Amtrak' s ability to spend these funds. Amtrak cannot 
expend IPRP funds on projects until it receives TSA's and 
FEMA's approval. However, a significant amount of time can 
pass between the grant award and project approval dates under the 
cooperative agreement approach. Therefore, funds that could 
address some of the more critical vulnerabilities at high-risk 
stations remain unexpended. 

Station-hardening measures are more critical mitigation efforts 
because they can prevent or mitigate the impact of terrorist attacks, 
especially from vehicle-borne improvised explosive devices. They 
can also protect Amtrak passengers, employees, and critical 
infrastructure assets integral to the safety and stability of the 
national passenger rail system. These measures include bollards, 
fixed and/or retractable barriers, planters, gate checkpoints, 
lighting and fencing, and closed circuit television systems. 

From 2005 to 2010, TSA and FEMA approved 56 IPRP projects 
for Amtrak. Nine of the 56 projects totaling $29.5 million 
implement station-hardening measures. The remaining 47 
projects, accounting for $67.5 million, are for security initiatives 
that include employee training, expansion of canine teams, bridge 



5 Amtrak may need to obtain approval from a State Homeland Preservation Office in order to comply with 
FEMA's Office of Environmental and Historical Preservation project review. 
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hardening, and further assessments of station vulnerabilities. See 
Figure 3 for the types of approved security IPRP projects. 



Figure 3: Approved Amtrak Security Projects, FY 2005-2010 
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As of December 31, 2010, Amtrak had expended only $4.9 million 
(16%) of the $29.5 million approved for rail station-hardening 
projects. Most of the unexpended funds are for six projects: two 
each from fiscal years 2008 and 2009, and one each from fiscal 
years 2007 and 2010. Table 1 lists the status of funds for the nine 
rail station-hardening projects. 
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Table 1: Funds Allocated to Rail Station Hardening Projects 



Grant 
Year 


Investment Justification 
Project Description 


Amount 
Approved 


Amount 
Expended 


2005 


Technical Support Working 
Group 


$ 873,765 


$ 873,765 


2007 


Camera Consolidation and 
Video Management 


3,000,000 


2,873,943 


2007 


CCTV 






1,000,000 


782,966 


2007 


Hardening 




1,350,000 


67,900 


2008 


Access Control 


1,125,000 





2008 


CCTV and Communications 


3,787,500 


257,128 


2009 


CCTV and Video Analytics 


4,800,000 





2009 


Station and Facility 
Hardening 


5,350,000 





2010 


Infrastructure Protection 


8,200,000 





Total 




$29,486,265 


$4,855,702 



TSA's cooperative agreement approach contributed to significant 
delays in approving rail station-hardening projects. GAO 
reported 6 the cooperative agreement process was a factor for why 
transit agencies expended only 3% of 2006 to 2008 TSGP funds. 
FEMA awarded the 2009 IPRP grant to Amtrak on July 31, 2009; 
however, TSA did not approve the investment justifications for the 
two rail station projects until July 29, 2010. The approach requires 
a back-and-forth discussion between Amtrak and TSA officials 
that can take many months to complete. TSA officials explained 
outside factors affected approval of this particular investment 
justification. For example, Amtrak pulled approved projects back 
as a result of changes in security priorities and leadership. The 
TSA officials indicated that the approval process for the two 
station projects was timely once they received a final investment 
justification from Amtrak. 



6 GAO-09-49 1 Transit Security Grant Program — DHS Allocates Grants Based on Risk, but Its Risk 
Methodology, Management Controls, and Grant Oversight Can Be Strengthened, June 2009. 
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Other Challenges Impacting Rail Station Vulnerabilities 



During the course of audit fieldwork, TSA and FEMA had not 
finalized a memorandum of understanding for managing the TSGP 
and IPRP. Both GAO and the OIG had previously recommended 
that TSA and FEMA finalize such a memorandum. As discussed 
earlier, TSA does not have documented procedures for its role in 
the grant award process. Such procedures would help the agency 
with closing prior GAO and OIG recommendations 7 for TSA and 
FEMA to finalize a memorandum of understanding or similar 
document defining their roles and responsibilities for awarding and 
managing grants. According to a 2009 GAO report on TSGP, 

'Articulating roles and responsibilities for managing the 
TSGP could strengthen TSA and FEMA's ability to ensure 
that activities, processes, and resources are aligned to 
achieve a common outcome and ensure smooth 
coordination during the grant process." 

TSA and FEMA finalized a memorandum of understanding for the 
TSGP program in March 201 1 . This memorandum should help to 
strengthen the implementation, administration, oversight, and 
internal controls of the TSGP. 

Conclusion 

Each year, DHS provides millions of dollars to Amtrak and transit 
agencies to reduce risk and strengthen the Nation's rail and transit 
systems. TSA can do more to ensure that Amtrak uses grant funds 
to protect rail stations from terrorism. TSA should work with 
Amtrak to develop a corrective action plan to mitigate potential 
gaps in security at Amtrak' s high-risk rail stations. Without a 
comprehensive plan for addressing identified vulnerabilities and 
documented internal procedures for awarding TSGP and IPRP 
grants and approving projects, the traveling public remains at risk 
for a potential terrorist attack at Amtrak's high-risk stations. 



7 Ibid.; OIG-10-69, Efficacy of DHS Grant Programs, March 22, 2010. 

8 GAO-09-491, Transit Security Grant Program: DHS Allocates Grants Based on Risk, but Its Risk 
Methodology, Management Controls, and Grant Oversight Can Be Strengthened, June 2009, p. 25. 
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Recommendations 



We recommend that the Assistant Administrator, Transportation 
Security Network Management: 

Recommendation #1 : Require the Transportation Sector Network 
Management, Mass Transit and Passenger Rail Division, to work 
closely with Amtrak to establish a corrective action plan that 
ensures decisions to fund Amtrak rail station remediation projects 
focus on mitigating the highest vulnerabilities identified by 
previous risk assessments. The plan should include the following: 

• Preliminary strategies and designs specifying the 
identification and commitment of all interested parties, to 
be presented during the grant application process to 
facilitate prompt mitigation efforts, 

• Details on the amount of funding needed to address the 
most critical vulnerabilities, and 

• Milestones for the timely approval of mitigation projects. 

Recommendation #2 : Ensure that the Transportation Sector 
Network Management, Mass Transit and Passenger Rail Division, 
creates and reports internal procedures that describe how the 
agency will carry out its roles and responsibilities in the grant 
award process for ensuring that Amtrak and other grant recipients 
address the highest priority security vulnerabilities. 

Management Comments and OIG Analysis 

DHS concurred with both recommendations in the report and TSA 
has already begun to implement actions to address the 
recommendations. We consider the recommendations unresolved 
and open. A summary of the agency's response follows. 

TSA Comments to Recommendation #1; 

TSA Concurs: DHS advised the OIG that forthcoming regulations 
will require Amtrak to develop a formal security plan with 
corrective actions. TSA's Office of Transportation Sector 
Network Management, Mass Transit and Passenger Rail Security 
Division, is currently engaged with Amtrak to develop a 
comprehensive security plan including corrective actions. The 
regulation, required by the Implementing Recommendations of the 
9/1 1 Commission Act of 2007 (Public Law 1 10-53), will serve as 
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the basis for DHS's coordination with Amtrak in developing their 
system wide security plan. TSA will also include, as part of our 
internal procedures, performance metrics to ensure the timely 
approval of Amtrak security projects. 

Until the regulation is finalized, DHS will review critical 
vulnerabilities with Amtrak throughout each grant cycle to 
determine their feasibility for funding, including reviewing and 
discussing mitigation options for the assets on Amtrak's security 
"quilt." Also, TSA began conducting a Baseline Assessment for 
Security Enhancement review for the entire system in March 201 1 . 
Through this review, DHS will engage in strategic planning and 
corrective action discussions with Amtrak for mitigating critical 
vulnerabilities. 

OIG Analysis: 

The OIG recognizes TSA's efforts to issue a security plan 
regulation to assist the coordination with Amtrak in developing 
their system wide security plan. TSA's new performance metrics 
should also help the timely approval of Amtrak security projects. 
The OIG needs to obtain and review the requirements for 
corrective action plans to ensure decisions to fund Amtrak rail 
station remediation projects focus on mitigating the highest 
vulnerabilities identified by previous risk assessments. This 
recommendation will remain unresolved until we receive the 
corrective action plan and identification of the responsible 
officials. The recommendation will remain open until we receive 
all additional information on the formal security plan with 
corrective actions, future requirements, and performance metrics to 
ensure the timely approval of Amtrak security projects. 

TSA Comments to Recommendation #2: 

TSA Concurs: FEMA and TSA finalized a Memorandum of 
Agreement in March 201 1, outlining the roles and responsibilities 
of each agency in managing surface transportation grant programs. 
TSA will use the Memorandum of Agreement as a starting point in 
creating internal procedures to clearly document how TSA will 
carry out its roles and responsibilities. 
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OIG Analysis: 



FEMA and TSA will identify and document how the agencies will 
carry out its roles and responsibilities in the grant award process. 
This will assist both agencies for ensuring that Amtrak and other 
grant recipients address the highest priority security vulnerabilities. 
This recommendation will remain unresolved until we receive and 
review the corrective action plan for internal procedures to clearly 
document how TSA will carry out its roles and responsibilities. 
We will close the recommendation once the roles and 
responsibilities are documented sufficiently to address the areas of 
concern identified in this report. 
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Appendix A 

Purpose, Scope, and Methodology 

The objective of our audit was to determine whether DHS ensures 
that recipients of the TSGP and IPRP mitigate high-priority 
security vulnerabilities at Amtrak rail stations and whether they 
coordinate risk mitigation projects to prevent duplication and avoid 
uneconomical use of grant funds. 

We reviewed federal legislation impacting the TSGP and IPRP, 
including the Aviation and Transportation Security Act of 2001, 
the Homeland Security Act of 2002, and the Implementing 
Recommendations of the 9/11 Commission Act of 2007. We 
reviewed GAO and DHS OIG reports and testimony to identify 
prior findings and recommendations related to the TSGP and IPRP. 

To determine whether the TSA and FEMA implemented the TSGP 
and IPRP in accordance with policies and procedures, we reviewed 
Amtrak's decision meeting minutes and approved project 
investment justifications, and compared them with Amtrak's 
project prioritization list. We determined the amounts of IPRP 
funds expended for Amtrak's fiscal years 2005-2010 IPRP projects 
as of December 31, 2010 by obtaining and reviewing Categorical 
Assistance Progress Reports for fiscal years 2005-2010, and 
Federal Railroad Administration drawdown data for fiscal years 
2008-2010. 

To determine whether grant recipients coordinate, we interviewed 
representatives from the State Administrative Agencies for New 
York City and the National Capitol Region, and attended a 
Philadelphia Regional Transit Security Working Group meeting in 
Camden, NJ. We reviewed grant project descriptions for fiscal 
years 2007-2008 for the State Homeland Security Program, Urban 
Areas Security Initiative Program, and the TSGP, and compared 
the projects with Amtrak's projects to identify duplicative efforts 
funded by the various grant programs. 

We interviewed officials from Amtrak's Police Department and 
Financial Planning Office to obtain their perspective on the TSGP 
grant application, award, and oversight process. We identified 
their procedures for coordinating efforts with state and local grant 
recipients and the DHS agencies. We also identified the 
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challenges Amtrak faces in prioritizing how to use grant funds to 
secure rail stations. 

To identify roles and responsibilities in the grant award process, 
we interviewed personnel from TSA's Transportation Sector 
Network Management and FEMA's Grant Programs Directorate. 
We reviewed TSA and FEMA policies, procedures, and guidance 
related to evaluating, awarding, and monitoring grant programs to 
determine how the agencies manage the TSGP and IPRP. We 
reviewed DHS annual grant guidance and application kits for fiscal 
years 2005-2010 to determine if TSA and FEMA provided clear 
guidance to Amtrak on the purpose and priority for use of IPRP 
grant funds. 

We obtained and reviewed analyses that the Science Applications 
International Corporation performed during 2005 to 2008 on 
Amtrak' s assets. We obtained a briefing on the results of 
Lawrence Livermore National L aboratories assessments conducte d 
at the four locations we visited: Lt m '" ^•iiP^i %A 



vulnerabilities and recommendations for risk remediation at these 
four stations. The method of selecting our locations prevents us 
from projecting the findings on a national level, but one should not 
discount our findings since the rail stations visited are locations 
with a high number of travelers. 

We conducted this performance audit from September 2010 to 
February 201 1 pursuant to the Inspector General Act of 1978, as 
amended, and according to generally accepted government 
auditing standards. Those standards require that we plan and 
perform the audit to obtain sufficient, appropriate evidence to 
provide a reasonable basis for our findings and conclusions based 
upon our audit objectives. We believe that the evidence obtained 
provides a reasonable basis for our findings and conclusions based 
upon our audit objectives. 
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I .S. Dqiiirlmt'iu iif I lomulund Security 
\\ nshlnRton, DC MS28 



JUN 8 2011 




MEMORANDUM FOR: 



Anne L. Richards 

Assistant Inspector General for Audits 

U.S. Department of Homeland Security (DHS) 



FROM: 




Administrator 
Federal Emergency Management Agency 



SUBJECT: 



Response to Draft Report, DHS Grants Used 
for Mitigating Risks to A mtrak Rail Stations 



This memorandum constitutes the Transportation Security Administration's (TSA) and the 
Federal Emergency Management Agency's (FEMA) response to the DHS Office of the Inspector 
General (OIG) draft report entitled DHS Grants Used for Mitigating Risks to Amtrak Rail 
Stations, dated March 20 1 L 

In July 2010, the OIG initiated a reviewto determine the effectiveness of DHS grants for 
mitigating risks to Amtrak rail stations. The OIG's objective was to determine whether DHS 
ensures that recipients of the Transit Security Grant Program (TSGP) and the Intercity Passenger 
Rail Security Grant Program (IPRSGP), as a component of the TSGP, mitigate high-priority 
security vulnerabilities at Amtrak rail stations and whether the grant recipients coordinate risk 
mitigation projects to prevent duplication and avoid uneconomical use of grant funds. 

The OIG concluded that grant recipients coordinate risk mitigation projects at high-risk rail 
stations, thereby preventing duplication and avoiding uneconomical use of funds. However, OIG 
also concluded that critical vulnerabilities cited in risk assessments conducted by Amtrak remain. 
As a result, the traveling public may be at risk to a potential terrorist attack. The OIG stated that 
vulnerabilities remain because of the following: 

• TSA not requiring Amtrak to develop a system-wide security plan addressing its highest 
ranked vulnerabilities; 

• TSA approving Amtrak investment justifications for lower-risk vulnerabilities; and 
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• TSA not having internal roles and responsibilities documented for their role during the 
award process (funding priority development and project approval) 

The OIG audit team also recognized that the cooperative agreement approach allows Amtrak to 
use grant funds on lower priority projects at critical assets where Amtrak faces obstacles beyond 
its control, and therefore cannot implement higher priority projects at those critical assets. 

The draft report issued by OIG includes two recommendations: 

1 . Require the Transportation Sector Network Management, Mass Transit and Passenger 
Rail Division, to work closely with Amtrak to establish a corrective action plan that 
ensures decisions to fund Amtrak rail station remediation projects focus on mitigating the 
highest vulnerabilities identified by previous risk assessments. The plan should include 
the following: 

• Preliminary strategies and designs specifying the identification and commitment 
of all interested parties, to be presented during the grant application process to 
facilitate prompt mitigation efforts' 

• Details on the amount of funding needed to address the most critical 
vulnerabilities; and 

• Milestones for the timely approval of mitigation projects. 

2. Ensure that the Transportation Sector Network Management, Mass Transit and Passenger 
Rail Division, creates and reports internal procedures that describe how the agency will 
carry out its roles and responsibilities in the grant award process for ensuring that Amtrak 
and other grant recipients address the highest priority security vulnerabilities. 

DHS appreciates OIG's work in completing this audit and will use the information in the audit to 
assist our ongoing efforts to improve the efficiency and effectiveness of the grant programs. 
DHS is already working to resolve the issues identified in the audit by implementing solutions 
that address the recommendations contained in the report. However, there are key points that the 
report does not discuss, which, without the proper context, could lead to incomplete conclusions. 

Operational Activities are a Key Component of Layered Security Approach. DHS has worked 
closely with Amtrak to enhance their operational activities to complement and/or supplement 
capital projects. Operational activities include canine teams, mobile explosives detection 
screening teams, training, and public awareness campaigns. The draft report asserts that station 
hardening measures are "more critical" mitigation efforts because they can prevent or mitigate 
the impact of terrorist attacks, but the role of operational measures is just as important in critical 
infrastructure protection. In cases where capital projects cannot be undertaken or will take 
several months to implement {including for the reasons mentioned below), operational activities, 
including unpredictable deterrence measures, provide an effective deterrent and act as a 
mitigating effort for critical assets. Amtrak invests significant internal resources, as well as 
IPRSGP resources, for operational activities including mobile screening teams, canine teams, 
public awareness campaigns, intelligence gathering and analysis, and employee training. 
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Environmental and Historical Preservation Considerations. The report's primary conclusions 
may lead to the inaccurate conclusion that DHS and Amtrak are intentionally funding lesser 
vulnerabilities at the expense of more critical ones. As set forth above, the report provides three 
primary reasons why Amtrak has not mitigated certain critical vulnerabilities. Because certain 
critical vulnerabilities cannot be addressed (e.g. because Amtrak does not own all of their 
stations), DHS and Amtrak believe it reasonable to use the funding to reduce other 
vulnerabilities rather than leaving these — albeit lesser — vulnerabilities remaining by returning 
the grant funding to the Treasury. In this way, DHS and Amtrak ensure that all grant funding is 
used to reduce vulnerabilities, which makes the public more secure by using this process. 

While acknowledging that Amtrak encounters obstacles in addressing critical vulnerabilities, the 
report's primary conclusions do not consider that critical vulnerabilities have not been addressed 
because of environmental and historic preservation considerations. Specifically, Amtrak requires 
approval from Historic Preservation Offices and other related entities if the project requires 
ground disturbance, or if it requires installation on historic/older assets. If these approvals are not 
provided for a project, Amtrak is statutorily precluded from funding the project. 

DHS and Amtrak Engage in Security Planning and Corrective Action Discussions. Also, TSA 
began conducting a Baseline Assessment for Security Enhancement (BASE) review for the entire 
system in March 201 1 . DHS and Amtrak have continuous discussions regarding security 
planning and mitigation activities through grant-funded projects even though grant guidance did 
not require Amtrak to develop a formal security plan or corrective action plan. Forthcoming 
regulations will require Amtrak to develop a formal security plan with corrective actions. 
Nonetheless, DHS still reviews critical vulnerabilities with Amtrak throughout each grant cycle 
to determine their feasibility for funding, including reviewing and discussing mitigation options 
for the assets on Amtrak's security "quilt." In these ways, DHS engages in strategic planning 
and corrective action discussions with Amtrak for mitigating critical vulnerabilities. 

Cooperative Agreement Approach Enhances Security Discussions and Project Approvals. DHS 
implemented, and has continued to use, the cooperative agreement (CA) approach for grantees in 
the highest-risk regions, including Amtrak, since the fiscal year (FY) 2007 grant process to 
facilitate security and project discussions. The CA approach allows for continuous and open 
dialogue between DHS and potential grantees, where a traditional grant limits federal agency 
participation. When this approach was first implemented in 2007, DHS's review and approval of 
projects did impact the performance period of the grant. TSA has since streamlined its processes 
so that the CA process no longer affects the grant period of performance, provided the projects 
are submitted for review in a timely manner. This streamlined CA approach has reduced the 
time between formal submission of a proposed project and approval because it allows for open 
and continuous discussion of the project before formal submission. This open and continuous 
dialogue ensures that a quality proposal is submitted the first time, thereby avoiding the time- 
consuming review of multiple iterations through a formal "submit-review-feedback-resubmit" 
process. This approach also allows DHS to be flexible when national or local priorities change 
or new needs emerge, as was the case with the FY 2009 award. (After the FY 2009 award was 
made, Amtrak's leadership revised its security priorities, which concomitantly adjusted its slate 
of projects. While it took Amtrak until July 2010 to finalize its project submissions, TSA and 
FEMA were able to review and approve them within a matter of days. Without the CA approach, 
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it would have been more difficult and time consuming for Amtrak to have been able to adjust 
grant projects to meet changing priorities. In addition, DHS would have had difficulty in 
maintaining close communication with Amtrak during this period, as the stipulations of a grant 
versus a cooperative agreement prevent open, continuous dialogue between DHS and grantees. 
Therefore, in this situation, the CA process allowed for speedy project approvals once the final 
project submission was received.) 

FEMA is Responsible for All Fiduciary Activities and Management Oversight Related to the 
Grant Programs. TSA provides the surface transportation security programmatic subject matter 
expertise for the grant programs, but FEMA is responsible for administering grant awards and 
ensuring compliance with all applicable laws, regulations, and policies, including Office of 
Management & Budget circulars and financial management standards. FEMA has legal 
responsibility to ensure that grants are awarded in alignment with the circulars and standards. 

DHS appreciates OIG's efforts on ensuring security grants are coordinated efficiently and used 
effectively to reduce vulnerabilities at critical assets identified through vulnerability assessments 
and security plans, and, overall, believes OIG's recommendations will enhance these programs. 
DHS has already begun to implement actions to address the recommendations contained in the 
report. Our specific responses to the two recommendations follow. 

Recommendation #1 : Require the Transportation Sector Network Management, Mass 
Transit and Passenger Rail Division, work closely with Amtrak to establish a corrective 
action plan that ensures decisions to fund Amtrak rail station remediation projects focus 
on mitigating the highest vulnerabilities identified by previous risk assessments. The plan 
should include: 

• Preliminary strategies and designs specifying the identification and 
commitment of all interested parties, to be presented during the grant 
application process to facilitate prompt mitigation efforts, 

• Details on the amount of funding needed to address the most critical 
vulnerabilities, 

• Milestones for the timely approval of mitigation projects. 

DHS concurs with this recommendation. The TSA Office of Transportation Sector Network 
Management (TSNM), Mass Transit and Passenger Rail Security (MTPRS) Division is engaged 
with Amtrak to develop a comprehensive security plan including corrective actions. 

TSA is actively working on issuing a security plan regulation, which would cover Amtrak, as 
required by the Implementing Recommendations of the 9/11 Commission Act of 2007 (Public 
Law 1 1 0-53). Once complete, this regulation will serve as the basis for DHS's coordination with 
Amtrak in developing their system-wide security plan. In the interim, the TSNM/MTPRS 
Division is already working closely with Amtrak in conducting a BASE review for the entire 
system, which was initiated in March 201 1 . The plan is to conduct one regional assessment per 
year, complete the entire system over a 3-year timeframe, and then reassess. This approach puts 
Amtrak on the same 3-year cycle of BASE reviews as other agencies. The BASE review for the 
Northeast Corridor has already begun. The BASE review, along with the foundation Amtrak has 
already built through their prioritization "quilt" and previous site and system assessments, will 
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identify vulnerability gaps that need to be addressed. TSNM/MTPRS will work with Amtrak to 
take the results of the BASE to inform a comprehensive security plan that will include strategies, 
designs, and costed mitigation efforts. Further, we will include, as part of our internal 
procedures (per recommendation #2 below), performance metrics to ensure the timely approval 
of Amtrak security projects. 

Recommendation #2 : Ensure the Transportation Sector Network Management, Mass 
Transit and Passenger Rail Division, creates and reports internal procedures that describe 
bow the agency will carry out its roles and responsibilities in tbe grant award process for 
ensuring that Amtrak and other grant recipients address the highest priority security 
vulnerabilities. 

DHS concurs with this recommendation. Work on this effort is already underway. FEMA and 
TSA finalized a Memorandum of Agreement (MOA) in March 201 1, outlining the roles and 
responsibilities of each agency in managing surface transportation grant programs, including 
TSGP and EPRSGP. TSNM/MTPRS will use the MOA as a starting point in creating internal 
procedures to clearly document how TSA will carry out its roles and responsibilities that are 
outlined in the FEMA/TSA MOA, including the development of funding priorities, project 
selection criteria, and award recommendations. TSNM/MTPRS aims to have these procedures 
complete for the FY 2012 grants cycle. 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



